Examples of systems of internal control

The following examples are illustrative only. These examples show practical ways an entity may design, implement and review their system of internal control and related assurance activities. They are generic examples and do not describe any specific Commonwealth entity.

The examples include better practice internal controls such as:

Monitoring and assurance

• Entities embed audit and assurance within governance, supported by formal structures (for example, audit and risk committees) to provide independent oversight of internal controls.
• Assurance activities are risk‑based and aligned to key priorities, focusing on areas of highest risk or importance to achieving objectives.
• Entities undertake ongoing monitoring of controls, with clear accountabilities and defined tolerances, and take corrective action where controls are not operating effectively, including reviewing controls when there are changes to risk levels or the operating environment.
• Entities use a combination of management oversight and internal audit to assess whether controls are working as intended.

Reporting and accountability

• Entities establish clear performance and reporting frameworks that align with their objectives and key activities.
• Reporting provides timely, accurate and relevant information to support decision-making and demonstrate accountability.
• Entities use reporting to inform decisions and drive improvement, not just to meet external obligations.
• Entities ensure reporting supports transparency and accountability to stakeholders, including government and the public.

A non-corporate Commonwealth entity is responsible for administering a grants program that provides funding to support infrastructure projects. The accountable authority is responsible for ensuring the program is supported by an appropriate and effective system of internal control.

To assess effectiveness, the entity draws on a range of assurance activities, including:

• regular management reporting on program delivery, including application volumes, assessment timeframes, and payment accuracy
• compliance checks and quality assurance reviews of assessment processes and decisions
• monitoring of conflicts of interest declarations and breaches
• internal audit reviews of program design and delivery
• analysis of incidents, complaints and audit findings to identify control weaknesses.

The audit and risk committee reviews reports on program risks, control performance and control failures, and provides advice to the accountable authority on the appropriateness of the entity’s systems of risk oversight, management and internal control. It also monitors the implementation of audit recommendations.

The entity has clear records supporting the program’s system of internal control, including:

• a clear program framework, including guidelines that set out eligibility criteria, assessment processes and decision-making authorities
• documented delegations and approvals that define who can assess applications, approve funding and enter into grant agreements
• risk assessments specific to the program, identifying key risks such as conflicts of interest, fraud, inconsistent assessments and delivery delays
• controls embedded in program systems and processes, including application tracking, segregation of duties, and documented assessment records
• standardised assessment templates and moderation processes to support consistent and transparent decision-making
• controls over payments and milestone reporting to ensure funds are released in line with internal procedures and agreed outcomes.

The entity emphasises that controls are tailored to the scale and risk profile of the program and are integrated with the entity’s broader governance and risk management arrangements.

The entity periodically reviews the program’s control framework, including after major funding rounds or changes in program settings, to ensure controls remain proportionate, fit-for-purpose and operating effectively.

Context

A non‑corporate Commonwealth entity recognised the need to strengthen and better articulate its system of internal control to support the accountable authority’s obligations under the PGPA Act. While a range of policies, procedures and controls existed across the entity, there was no single, integrated framework that clearly explained how these elements worked together, who was responsible for them, or how their effectiveness was monitored and improved.

Senior management agreed to develop an internal controls framework to provide a consistent, entity‑wide approach to understanding, applying and assessing internal controls.

Approach taken

The entity developed an internal controls framework aligned to recognised better practice and existing Commonwealth guidance. The framework was designed to:

• clearly define what is meant by internal control in the context of the entity’s operations
• describe the key components of internal control and how they support effective governance, risk management and assurance
• explain the roles and responsibilities of staff, managers, specialist functions and internal audit
• provide practical guidance on identifying, designing and assessing controls in day‑to‑day activities.

To ensure the framework was practical and embedded, it was developed through consultation with business areas, assurance providers and governance bodies. Existing controls, artefacts and processes were mapped to avoid duplication and to reinforce that internal controls are part of business‑as‑usual activity, not an additional compliance exercise.

Embedding and use

The framework was supported by tools such as a structured self‑assessment checklist and worked examples, enabling business areas to assess the effectiveness of controls within their areas of responsibility. It was explicitly linked to the entity’s risk management and assurance frameworks, reinforcing how controls operate as the primary means of managing risk and providing assurance to senior management and the accountable authority.

Responsibility for maintaining and reviewing the framework was assigned to a central assurance function, with a commitment to periodic review to ensure it remained current and fit for purpose.

Outcome and lessons learned

The development of the internal controls framework provided greater clarity and consistency across the entity’s control environment. Staff and managers reported improved understanding of their responsibilities, and senior management gained increased confidence that internal controls were being applied in a structured and systematic way.

This example demonstrates how developing a clear, principles‑based internal controls framework can strengthen governance and assurance without creating additional burden. By focusing on integration, clarity and practical application, the entity enhanced its ability to meet accountable authority obligations and support continuous improvement in internal control maturity.

Context

A large non‑corporate Commonwealth entity with complex regulatory and service delivery responsibilities sought to strengthen assurance to the accountable authority about the appropriateness of the system of internal control. While a wide range of controls, policies and risk frameworks were in place, these elements had developed over time and were not clearly described or managed as a single, integrated system of internal control.

What the entity did

The entity undertook an entity‑wide exercise to understand and articulate how its system of internal control operated in practice. Using recognised better practice as a reference point, specifically, in this case, Principle 2 of TPP20-08 Internal Audit and Risk Management Policy for the General Government Sector, the work focused on identifying existing controls and assurance activities and mapping them to the key components of internal control.

Rather than creating new controls, the emphasis was on clarifying how existing controls worked together, who was responsible for maintaining and evaluating controls, and how control effectiveness was monitored and communicated. The approach was supported by desktop reviews, structured mapping and engagement with senior leaders, business areas and assurance providers to build a shared understanding of the system.

What was identified

The exercise confirmed that many foundational controls were operating effectively, particularly in governance, risk management and control activities. It also highlighted system‑level challenges common in large entities, including unclear ownership of the system as a whole, uneven approaches to monitoring control effectiveness, and limited visibility of control issues across organisational boundaries.

Outcome and lessons

The entity used these insights to develop a clear, principles‑based description of its system of internal control. This strengthened integration between internal controls, risk management and assurance arrangements, improved clarity of roles and responsibilities, and provided a stronger basis for accountable authority assurance.

This example demonstrates that strengthening a system of internal control often involves making existing arrangements visible and coherent, rather than adding new layers of control. Clear articulation, ownership and integration are key enablers of effective internal control under the PGPA framework.

In this example, a small entity with a single outcome does not have an internal audit function. The accountable authority still requires assurance that key controls operate effectively, particularly for higher‑risk activities and compliance with finance law.

The entity, through its key management personnel and corporate function, used a mix of assurance approaches, including:

• scheduled management reviews of key controls
• reporting on control issues and actions to governance committees and the audit committee
• periodic independent reviews using co‑sourced or shared arrangements where appropriate.

The accountable authority was satisfied that these approaches were proportionate to the entity’s size and risk profile. While the entity did not have a standalone internal audit function, the entity embedded complementary layers of assurance to provide sufficient confidence its system of internal control was operating effectively.

Where independent reviews were used, the entity:

• defined the scope and reporting arrangements clearly
• ensured findings were reported to the accountable authority or audit committee
• tracked agreed actions to completion.

A Commonwealth entity identified potential non-compliance associated with the administration of payments. The matter was disclosed through the entity’s established reporting arrangements, and corrective action was taken to address the immediate issues.

To obtain further assurance, the accountable authority commissioned a management-initiated review led by the entity’s internal audit function. The review examined whether the corrective actions were appropriate and effective, and whether further improvements were needed.

The review identified opportunities to strengthen controls across the payment lifecycle. In particular, some controls continued to rely on:

• manual processes
• individual judgement
• informal coordination between relevant areas.

These limitations reduced the entity’s ability to obtain end-to-end assurance that payments were consistently processed in accordance with relevant requirements.

Entity response

The entity agreed to pursue further improvements to strengthen the design, consistency and enforceability of its payment controls. It also continued reviewing relevant risks and authorisations and retained established arrangements for reporting any further potential non-compliance.

Lessons

This example demonstrates that a control incident does not necessarily mean an entity’s overall system of internal control is ineffective. However, it may identify weaknesses in how individual controls operate together.

A targeted internal audit or independent review can help an accountable authority:

• assess whether corrective actions have addressed the immediate issue
• understand the underlying causes of control failure
• identify residual risks and opportunities for improvement
• obtain assurance that controls are appropriately designed and operating as intended
• support continuous improvement without introducing unnecessary controls.